tanstack-ai-memory
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill serves as a technical guide for using the @tanstack/ai-memory package.
- [PROMPT_INJECTION]: The skill facilitates the ingestion of external data into the agent's prompt via memory adapters. This creates a surface for indirect prompt injection, but the documentation provides remediation guidance by instructing developers to resolve and validate memory scopes server-side using trusted session state.
- Ingestion points: The recall method in SKILL.md fetches content from external storage.
- Boundary markers: Not explicitly defined in the provided code snippets.
- Capability inventory: No dangerous capabilities such as file system writes or subprocess execution are present.
- Sanitization: The skill includes a 'Scope security' section that mandates server-side validation of userId and threadId to prevent cross-user data leakage.
Audit Metadata